
Microsoft 365 sign-in logs show unfamiliar locations because Microsoft normally estimates location from the connection’s public IP address, not the user’s physical position. VPNs, mobile networks and security proxies can explain unexpected countries or cities, but compromised accounts can produce similar records. Treat location as supporting evidence, rather than proof...











